chore: License the repository under AGPL-3.0-or-later by MartinZikmund · Pull Request #492 · MartinZikmund/Awaitick

MartinZikmund · 2026-09-03T12:13:32Z

Relicenses the repository from GPL-3.0 to AGPL-3.0-or-later, with an Apple App Store exception, a contributor agreement, a trademark policy, third-party notices, and the community health files GitHub looks for.

No identifier, version, manifest, signing setting or entitlement is touched — verified file-by-file below.

What changed

Licensing

LICENSE — replaced with the verbatim AGPL-3.0 text from gnu.org (diffed byte-for-byte, so GitHub's detector reports AGPL-3.0)
COPYING.iOS — Apple App Store additional permission under AGPLv3 §7. Kept in its own file so LICENSE stays pristine. Grants the permission to anyone shipping through the App Store / Mac App Store, not just official builds, and is removable from modified copies per §7
LICENSING.md — plain-English guide: what the AGPL asks, what §13 means, why the exception exists
TRADEMARKS.md — reserves the Awaitick name, logo, icon and splash artwork, with a file-by-file rebranding checklist for forks
CLA.md — Apache-ICLA-style one-pager; contributors keep their copyright
THIRD-PARTY-NOTICES.md — every dependency, grouped by licence

Project metadata — src/Directory.Build.props gains PackageLicenseExpression, PackageProjectUrl, RepositoryUrl, Authors; Copyright updated to 2020-present (2020 is the first commit year).

In-app disclosure — Settings' existing About section gains two cards; a new licences page shows the copyright, licence, source URL and all third-party notices. Notices are compiled in as data, never fetched over the network, so they render identically offline on every target. Strings added to both en-US and cs-CZ.

Community files — README (was a single heading), CONTRIBUTING, CODE_OF_CONDUCT (verbatim Contributor Covenant 2.1), SECURITY, PR template with CLA checkbox, CODEOWNERS, and a CLA Assistant workflow. Existing issue templates left untouched.

Hygiene — .gitignore now covers keystores, JKS, P12, certificates, provisioning profiles, Google service-account files and .env.

Why AGPL and not GPL

There is no backend today — this repo is the Uno app head plus a shared library, and the Azure Static Web App is pure static WASM hosting with no api_location. AGPL is still the right call: the WASM build is network-served, and §13 future-proofs a backend if one is ever added. LICENSING.md is written accordingly — it frames §13 as "if you host a modified copy" rather than describing something already running.

Relicensing needed nobody else's consent: every commit is either Martin Zikmund's or a bot's (dependabot, copilot-swe-agent). GPLv3 §13 permits AGPL relicensing in any case.

Verification

Builds: desktop, Windows and Android all 0 errors. iOS and WebAssembly left to CI (no Mac, no wasm-tools locally). The Windows head needs msbuild rather than dotnet build — pre-existing UNOB0008, same as CI does
The licences screen was driven in the real packaged Windows app, not just compiled — Settings → About → Open-source licenses navigates correctly and renders the copyright, AGPLv3 line, repo URL, and expandable per-licence package lists
No test project exists, so there was nothing to run
Store-critical files confirmed unchanged: Package.appxmanifest, Info.plist, AndroidManifest.xml, Awaitick.csproj, version.json, global.json. The Version="0.0.0.0" guard still holds
Secrets: clean in the working tree and full history. All 17 signing credentials already go through Actions secrets

Flagged — not fixed here

CommonServiceLocator is MS-PL, which the FSF calls GPL/AGPL-incompatible. It ships transitively via Uno Platform. Fix submitted upstream: feat!: Replace CommonServiceLocator with IServiceProvider in LogExtensionPoint unoplatform/Uno.Core#94 — once that lands in an Uno.WinUI release it disappears from the graph and can be dropped from the notices
16 of 25 bundled background images have no attribution. Nine trace to PublicDomainPictures.net via Attributions.txt; the rest have no recorded source. If they are original work, one sentence closes it
8 Uno packages declare no licence in their .nuspec — almost certainly Apache-2.0, but unverifiable from the package
Microsoft.WindowsAppSDK ships under a proprietary EULA — the usual "System Library" reading of AGPLv3 §1 covers it

Also for the record: IAP entitlements are validated client-side only, with no receipt server. On iOS/Android/WASM/Desktop ProStoreService.HasProAsync() returns true unconditionally, so Pro is currently ungated there. No code changed for this.

Manual steps after merge

Create the cla-signatures branch — signatures are stored there deliberately, so signing doesn't trigger CI and the Static Web Apps deploy on main
Install/authorise the CLA Assistant GitHub App
Enable private vulnerability reporting (Settings → Security), which SECURITY.md links to
Add a repo description and topics — the last community-standards item that isn't a file
Add the repo URL to the store listings
Optionally create a good first issue label (CONTRIBUTING.md links to it)

🤖 Generated with Claude Code

https://claude.ai/code/session_01XD6CXamcmygU1ErZvjfc9v

Replace the verbatim GPL-3.0 text with the verbatim AGPL-3.0 text from gnu.org, so the network-use clause (section 13) covers any future hosted component and GitHub keeps detecting the licence from the root LICENSE. Apple's App Store terms conflict with AGPLv3 sections 6 and 10, so grant an additional permission under section 7 in a separate COPYING.iOS rather than editing the licence text itself. Martin Zikmund is the sole human copyright holder (every other committer is a bot), so no third-party consent was required for the relicensing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XD6CXamcmygU1ErZvjfc9v

LICENSING.md is the plain-English entry point: what the AGPL asks, what section 13 means for a network-served build, and why the App Store exception is a separate file. It says outright that no backend exists yet, so nobody reads the network clause as describing something that is already running. TRADEMARKS.md reserves the Awaitick name, logo, icon and splash artwork, and gives forks a concrete file-by-file rebranding checklist. CLA.md keeps the contributor's own copyright while granting the licence breadth needed to keep publishing on stores and to relicense if required. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XD6CXamcmygU1ErZvjfc9v

Enumerates every NuGet package resolved across the desktop, Windows, Android and iOS targets (205 shipped, 12 build-time only), grouped by licence, plus the bundled Inter font and the public-domain event backgrounds. Build tooling is separated out from shipped dependencies and each exclusion is backed by the PrivateAssets or Exclude metadata that causes it, so the proprietary Uno.Sdk.Extras EULA is not mistaken for something we ship. Four items are flagged rather than resolved: the MS-PL licence on CommonServiceLocator, sixteen unattributed background images, eight Uno packages with no licence element, and the Windows App SDK EULA. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XD6CXamcmygU1ErZvjfc9v

Settings' existing About section gains two cards rather than a second About screen: one showing the copyright and opening the new licences page, one linking to the repository. The page states the licence and source location and lists every third-party component, grouped by licence and collapsed into expanders so 200-odd package names stay readable. Notices are compiled in as data rather than read from a file or the network, so they render identically on every target and work offline. Views are discovered by naming convention, so this needs only the one DI registration. Strings added to both en-US and cs-CZ. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XD6CXamcmygU1ErZvjfc9v

The README was a single heading; it now describes the app, its targets and how to build one platform without installing every workload, and carries the licence, trademark and CLA summary with badges. CONTRIBUTING covers the build, the Core/head split, the localisation rule for both locales, Conventional Commits, and the duty to update the third-party notices in two places when dependencies change. CODE_OF_CONDUCT is the verbatim Contributor Covenant 2.1 with the maintainer's contact. SECURITY points at GitHub private vulnerability reporting and is honest that response times are one person's spare time, not an SLA. The PR template carries the CLA checkbox. Issue templates already existed and were left alone. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XD6CXamcmygU1ErZvjfc9v

Uses contributor-assistant/github-action pinned to v2.6.1, allowlisting the maintainer and the three bots that already appear in the history. Signatures are stored on a dedicated cla-signatures branch rather than main: a push to main triggers CI, the Static Web Apps deployment and the TODO scanner, and none of those should run because someone signed an agreement. That branch has to be created once before the workflow can commit to it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XD6CXamcmygU1ErZvjfc9v

Publishing the repository makes an accidentally committed keystore or provisioning profile a public one, so ignore the file types before that can happen. *.pfx and *.appxupload were already covered; keystores, JKS, P12, certificates, provisioning profiles, the Google service-account files and .env were not. Scanned the working tree and full history for these file types and for embedded key material: nothing found. Every signing credential is already referenced through GitHub Actions secrets. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XD6CXamcmygU1ErZvjfc9v

Copilot

🟡 Changes recommended

The third-party notices have multiple formatting/accuracy issues (split/merged package IDs) and the in-app notice data disagrees with the repo notices for at least one license grouping.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Relicenses Awaitick to AGPL-3.0-or-later and adds the accompanying legal/community documentation, plus an in-app Open-source licenses experience surfaced from Settings to disclose the license, source URL, and third-party notices offline across platforms.

Changes:

Replace GPLv3 with AGPLv3 text, add App Store additional permission, and introduce supporting legal docs (licensing guide, trademarks, CLA, third-party notices).
Add an in-app licenses page and Settings entry points, backed by compiled-in notice data and localized strings (en-US, cs-CZ).
Add GitHub community health files and a CLA Assistant workflow; expand .gitignore to cover common signing/secret artifacts.

File summaries

File	Description
TRADEMARKS.md	Trademark/brand reservation policy and fork rebranding checklist
THIRD-PARTY-NOTICES.md	Third-party dependency and bundled asset notices (repo-level disclosure)
src/Directory.Build.props	Package metadata updates (license expression, URLs, copyright)
src/Awaitick/Views/SettingsView.xaml	Adds Settings → About cards for licenses and source code
src/Awaitick/Views/LicensesView.xaml	New UI page for in-app open-source disclosures
src/Awaitick/Views/LicensesView.xaml.cs	Code-behind + base class wiring for the new licenses page
src/Awaitick/Strings/en-US/Resources.resw	Adds strings for licenses/source code UI
src/Awaitick/Strings/cs-CZ/Resources.resw	Czech equivalents for the new licenses/source code strings
src/Awaitick/App.xaml.cs	Registers `LicensesViewModel` with DI
src/Awaitick.Core/ViewModels/SettingsViewModel.cs	Adds navigation and launcher commands for new About entries
src/Awaitick.Core/ViewModels/LicensesViewModel.cs	New ViewModel powering the licenses page
src/Awaitick.Core/Models/Licensing/ThirdPartyNotices.cs	Compiled-in third-party notice data used by the app
src/Awaitick.Core/Models/Licensing/ThirdPartyNotice.cs	Notice model + group model for UI binding
src/Awaitick.Core/Models/Licensing/AppLicenseInfo.cs	Centralizes app license/source metadata for reuse
SECURITY.md	Security reporting policy and support scope
README.md	Expanded project overview, build instructions, and license summary
LICENSING.md	Plain-English licensing guide and rationale
LICENSE	Replaces GPLv3 text with AGPLv3 text
COPYING.iOS	App Store additional permission under AGPLv3 §7
CONTRIBUTING.md	Contribution workflow, CLA, build guidance, conventions
CODE_OF_CONDUCT.md	Contributor Covenant 2.1 code of conduct
CLA.md	Contributor Licence Agreement text
.gitignore	Adds patterns for signing materials and common secret files
.github/workflows/cla.yml	Adds CLA Assistant workflow
.github/PULL_REQUEST_TEMPLATE.md	PR checklist including CLA confirmation and notice updates
.github/CODEOWNERS	Adds ownership rules for legal/licensing documents

Review details

Suppressed comments (4)

THIRD-PARTY-NOTICES.md:61

This line break splits the package name "...FileProviders.Abstractions" and also drops the comma before "Microsoft.Extensions.FileProviders.Physical", which corrupts the list.

Microsoft.Extensions.Diagnostics.Abstractions,Microsoft.Extensions.FileProviders.Abstraction
s Microsoft.Extensions.FileProviders.Physical,Microsoft.Extensions.FileSystemGlobbing

THIRD-PARTY-NOTICES.md:70

Missing comma between "Newtonsoft.Json" and "Refit" causes the package list to merge two package names.

Microsoft.Xaml.Behaviors.WinUI.Managed,Newtonsoft.Json Refit,SkiaSharp

THIRD-PARTY-NOTICES.md:76

Several adjacent package IDs are missing commas, merging names together (e.g. "SkiaSharp.Resources SkiaSharp.SceneGraph"). This makes the notices inaccurate.

SkiaSharp.NativeAssets.macOS,SkiaSharp.Resources SkiaSharp.SceneGraph,SkiaSharp.Skottie 
SkiaSharp.Views,SkiaSharp.Views.Uno.WinUI SkiaSharp.Views.WinUI,System.Diagnostics.EventLog 
System.Json,System.Runtime.InteropServices.NFloat.Internal Tmds.DBus.Protocol

THIRD-PARTY-NOTICES.md:126

The "...ViewModelSavedState.Android" package name is split mid-word and the comma before "Xamarin.AndroidX.Loader" is missing, which corrupts the package list.

Xamarin.AndroidX.Lifecycle.ViewModelSavedState,Xamarin.AndroidX.Lifecycle.ViewModelSavedStat
e.Android Xamarin.AndroidX.Loader,Xamarin.AndroidX.LocalBroadcastManager

Files reviewed: 25/26 changed files
Comments generated: 3
Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+          github.event_name == 'pull_request_target' ||
+          github.event.comment.body == 'recheck' ||
+          github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA'
+        uses: contributor-assistant/github-action@v2.6.1


+		new("Microsoft software licence terms", "https://github.com/microsoft/WindowsAppSDK",
+		[
+			"Microsoft.Web.WebView2",
+			"Microsoft.WindowsAppSDK",
+		]),


+Microsoft.Extensions.Configuration.CommandLine,Microsoft.Extensions.Configuration.Environmen
+tVariables 


github-actions · 2026-09-03T12:18:43Z

Azure Static Web Apps: Your stage site is ready! Visit it here: https://calm-beach-0e6f0200f-492.eastus2.1.azurestaticapps.net

MartinZikmund and others added 7 commits September 3, 2026 10:53

Copilot AI lite review requested due to automatic review settings September 3, 2026 12:13

Copilot started reviewing on behalf of MartinZikmund September 3, 2026 12:14

View session

Copilot AI reviewed Sep 3, 2026

View reviewed changes

Navigation Menu

Repository navigation

chore: License the repository under AGPL-3.0-or-later - #492

chore: License the repository under AGPL-3.0-or-later#492
MartinZikmund wants to merge 7 commits into
mainfrom
feature/licensing

MartinZikmund commented Sep 3, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Sep 3, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		Microsoft.Extensions.Configuration.CommandLine,Microsoft.Extensions.Configuration.Environmen
		tVariables

Conversation

MartinZikmund commented Sep 3, 2026

What changed

Why AGPL and not GPL

Verification

Flagged — not fixed here

Manual steps after merge

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Suppressed comments (4)

Uh oh!

github-actions Bot commented Sep 3, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants